A new infostealer called VOLTA steals your passwords, reads your Gmail, then asks Claude what you are worth

VOLTA is a new Windows infostealer. It steals your passwords, cookies, saved cards and crypto wallets, and it reads your Gmail to check where you live. Then it sends everything it knows about you to an AI model with one job: write a report on what you are worth. Cisco Talos published its analysis on 31 October 2026, the same morning WIRED broke the story. The default model inside VOLTA is Anthropic's Claude Opus 4.6. If Claude's reply says "I can't" or "I'm not able", VOLTA sends the same request to Moonshot's Kimi K2, and then to Google's Gemini 2.5 Flash. The part of the report it wants most has a plain title: "WHAT THEY'RE WORTH".

I read the Talos report line by line, including the full prompt hidden inside the malware, and my view is simple. The AI in VOLTA does not steal anything. The stealing is done by the same kind of code criminals have used for years. The AI does the sorting, the slow work of reading a stolen log and deciding who to rob first and how. That work used to need a person's time. Now it costs well under a dollar per victim, and Talos thinks it comes packed in a kit made for selling to other criminals.

What is the VOLTA infostealer?

An infostealer is malware that copies saved logins and other private data from your computer and sends them to a criminal. It usually hides inside cracked software, fake game cheats or fake updates. VOLTA calls itself "VOLTA-AUTODOXER" inside its own code. To dox someone means to dig up who they are and expose it, so the name tells you what its author wanted.

VOLTA takes the usual haul and then some. According to Talos, it grabs passwords, cookies and saved cards from Chrome and other Chromium browsers, plus Firefox, Thunderbird and Outlook. It takes Discord, Telegram, Steam, Battle.net and Roblox sessions, Microsoft login tokens, Slack workspaces, SSH keys, cloud logins and screenshots. It pulls the password of every Wi-Fi network saved on your PC, in plain text. When it finds a locked crypto wallet, it runs a password cracker on it and writes the result on a "WALLET VAULTS CRACKED" line in its own report.

Then it does something most stealers never bother with. It uses your own logged-in sessions to learn more about you. With your Gmail login it searches your inbox for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart and PayPal, so it can confirm your home address. It opens your Uber Eats and DoorDash order history, looks up your Discord profile, and checks a Roblox trading site to put a price on your Roblox items. When it is done, it deletes itself.

The sample was first seen on 11 October 2026, and its build date points to August. Talos also told WIRED it did not track whether VOLTA has been used against real people yet. So this is a working tool with no confirmed victims so far, and that matters for everything below.

How does VOLTA use AI?

Once the stealing is done, VOLTA writes everything into a file called "Identity_Report.txt". It turns that file into a structured bundle and sends it to OpenRouter, a service that lets one account reach hundreds of AI models from different companies through one address. The request asks for Claude Opus 4.6 with a low temperature setting of 0.2, which makes the answers steadier and less creative. Talos says the request is put together by hand, without any official software kit, and labelled as if it came from a normal web browser.

The prompt is the most revealing part of the whole report. WIRED counted 240 words. It tells the model it is "a forensic intelligence analyst drafting a target assessment". The model must cite the evidence behind every claim and write "Not established" when the data says nothing. It may only use six phrases to say how sure it is: almost certainly not, unlikely, roughly even chance, likely, highly likely and almost certainly. That is the same kind of scale intelligence agencies use in reports for governments. Whoever wrote this prompt knew how real analysts write.

It also tells the model to connect dots. A Wi-Fi password that matches a surname, a school login page that matches a college email, a receipt address that matches the address saved in your browser. The report has ten parts, including "WHO THEY ARE", "WHAT THEY DO" and "WHAT THEY'RE WORTH", where your crypto, Roblox items, cards and accounts are ranked low, medium or high by how much money they can bring. Another part, "THEIR OPSEC", grades your security habits, your passwords and whether you use two-step login. The answer comes back as "AI_Analysis.txt", gets zipped with the identity report and lands in the criminal's Telegram. The stolen files went there earlier, in a separate zip.

Did Claude help VOLTA?

Nobody has shown that it did. Talos shows that Claude Opus 4.6 is the model VOLTA asks for first. It does not say what Claude answered, Anthropic had not commented on VOLTA in public as of 1 November, and Talos never published a single report the AI wrote. So anyone telling you "Claude helped hackers rob people" is going further than the evidence.

What the code does show is that the author expected a no. VOLTA reads each reply for phrases like "I can't" or "I'm not able". If it finds one, it tries Kimi K2, then Gemini 2.5 Flash. Ryan Fetterman, the Talos researcher behind the report, told WIRED the prompt is "carefully crafted not to imply anything overtly malicious". He said the authors planned to fall back to more permissive models down the chain. So a refusal from one model is a speed bump here, not a wall.

Two more details in the code matter. Talos's screenshot shows the code checks its settings for another model name first and only uses Claude Opus 4.6 when none is set, so the Claude name is a default that can be changed. And when I checked OpenRouter's public listing, a request for Claude Opus 4.6 there can be served by Anthropic or by Amazon Bedrock, Claude on AWS, Microsoft Azure or Google Vertex. Whichever company hosts it, it is the same model reading the same prompt.

The real reason this question is hard is the prompt itself. It never says "help me rob this person". It reads like a request a fraud team, a private investigator or a background-check firm could send. The danger only shows when you know where the data came from, and the model is never told. Anthropic's own rules ban using Claude to build dossiers on people to harm them, or to combine personal data from many sources into profiles that are sold or handed to others without the person knowing. Those rules only work when the model can see what it is being used for.

Criminals were already doing this by hand with Claude

VOLTA is not the first time this idea has shown up. Anthropic described something close to it in its August 2025 threat report. A criminal on a Russian-language hacking forum used Claude to go through stealer logs. Claude sorted the victims' websites into groups like social, gaming and dark web, and built a profile of each person's habits to decide who to go after first. The same report showed another criminal using Claude Code to read stolen money files and write a "profit plan", with a guess at what the data would sell for on the black market.

So the idea is more than a year old. What VOLTA adds is packaging. The person running it does not need to know how to use an AI model at all. They fill in a Telegram channel and an API key, and ranked dossiers arrive on their phone.

There is one more twist. Kimi K2, the first fallback, is made by Moonshot AI. In its September 2026 threat report, Anthropic accused Moonshot of secretly passing almost 300,000 of its own users' requests to Claude in ten days, through 5,380 fake accounts. Kimi users got Claude's answers as if they came from Kimi, and Moonshot saved Claude's reasoning to train its own models. So the backup plan for a refusal by Claude is a model whose maker Anthropic accuses of copying Claude.

Why the AI part matters more than it looks

Infostealers are not new, and the problem with them was never a shortage of stolen data. It was too much of it. In 2023, the threat intelligence firm KELA found criminal Telegram groups selling 90,000 to 300,000 logs a month for $90 to $150, less than a dollar a log. In 2024 one analysis counted about 10,000 new infostealer victims a day. SpyCloud's 2026 report counted 13.2 million new infostealer infections last year, exposing 642.4 million logins, and 8.6 billion stolen cookies in total. Nobody can read all of that. The scarce thing is a criminal's attention.

VOLTA hands that attention job to a model. Talos calls this "effort displacement". Its report ends by saying there is "a difference between a wide net and a wide net that sorts itself".

Speed matters here too. Fetterman pointed out to WIRED that stolen tokens expire and people change passwords. A criminal who knows within minutes that you hold crypto and use the same password everywhere can act before you notice. A criminal who gets to your log a month later finds dead sessions.

The sorting costs next to nothing. At OpenRouter's listed prices of $5 per million input tokens and $25 per million output tokens, a 30,000-token bundle and a 3,000-token report on Claude Opus 4.6 cost about 23 US cents by our count. The same report on Gemini 2.5 Flash costs about 2 cents. Because the AI call runs from your own computer over your own internet connection, the criminal does not even need a server. Talos found no attacker-owned machines anywhere in VOLTA.

And look at what the prompt asks the AI to notice. A school login page, a college email, Roblox account values, Discord and Steam sessions. WIRED's read was that VOLTA seems built to target younger people with busy online lives, and I agree. A tool that ranks victims by what they are worth and reads their school logins is pointed at the people least ready for it.

What people are saying about VOLTA

The biggest discussion so far is a Hacker News thread with about 240 points and 130 comments. Three views come up again and again. Some developers say an AI model is a clumsy tool for ranking and that cheaper code could do it. Others reply that for a criminal, good enough today beats perfect later. A big group of coders turned the talk to their own machines. AI coding tools already read files across a home folder, they said, so a poisoned tool update could do what VOLTA does in seconds. A third group said nothing here is new, since criminals have always picked rich targets first.

Security researchers have a sharper point. THORCollective, a group that shares free hunting guides for defenders, published one for VOLTA. It says you cannot stop VOLTA by blocking OpenRouter, because many companies use OpenRouter for real work. Defenders should look for the pattern instead. Something on the computer reads the password stores, sends one huge request to an AI service, sends the same request to a second and third service within seconds, writes a zip file and deletes itself. The guide says the most useful clue is the hand-built request with its fake browser label.

How to know if you have an infostealer

Most of the time you will not see anything. VOLTA, like many infostealers, runs once, sends the data and deletes itself. The signs show up later, in your accounts:

• a "new sign-in" alert from a place or device you do not recognise
• sessions you did not start in your Google, Microsoft, Discord or Steam security pages
• password reset or two-step login emails you did not ask for
• crypto leaving your wallet, or game items leaving your Roblox or Steam account
• friends getting strange messages from your Discord or Telegram

If you think you were hit, run a full scan with Windows Security or another antivirus first. Talos also says that if VOLTA itself ran, the file "volta_debug.txt" in your AppData folder lists exactly what it took and whether the AI step worked, so keep it for anyone helping you. Then, from a clean device, change your passwords and sign out of every session.

How to protect yourself from AI malware like VOLTA

Never install cracked software, game cheats or "free" versions of paid apps. This is one of the most common ways infostealers get onto a computer. In August 2026, Anthropic itself had to warn customers that infostealers had copied their logged-in Claude sessions.

Know that two-step login does not stop cookie theft. Two-step login guards the moment you sign in. An infostealer copies the cookie from a login that already passed that check, and the criminal loads it into their own browser. MITRE, which keeps the standard list of hacker techniques, describes exactly this. Two-step login still matters, because it stops a stolen password from opening your account, but it is not enough on its own.

Sign out of every device after a scare. For Google, go to myaccount.google.com, then Security & sign-in, then Your devices, then Manage all devices, and sign out of each session. Remove the malware first, or it will steal your next login too.

Keep Chrome updated. On Windows, Chrome 146 and later can tie your Google login to your computer's security chip, a feature called Device Bound Session Credentials, so a stolen Google cookie stops working on another machine. Google began turning it on in late May 2026. Most other sites' cookies, like Discord's or Steam's, are not protected this way yet. VOLTA's trick for getting around Chrome's earlier lock, called App-Bound Encryption, is to start a hidden copy of Chrome. Companies can block or flag that.

Never keep a seed phrase as a file, a screenshot, a note or an email. MetaMask's own guide says to keep it offline and written down. VOLTA searches your computer for wallets and phrases. If yours was ever saved as plain text on an infected computer, Talos says to treat the wallet as fully compromised and move the money to a new wallet.

Use a hardware wallet for crypto you cannot afford to lose, and buy it only from the maker. The key stays on the device, and every payment has to be confirmed on the device itself. On 30 October 2026, Trezor warned buyers about a wallet that may have been tampered with inside. It came from CryptoBilis, a shop in Southeast Asia that Trezor had approved as a seller until 9 October. The shop matters as much as the wallet.

Does VOLTA affect people in India?

There is no sign that VOLTA has targeted India, and the receipt list shows who it was built for first. DoorDash, Grubhub and Walmart are US services, and there is no Swiggy, Zomato or Flipkart on the list. Amazon is on it, though, and Indian inboxes are full of Amazon receipts.

Everything else works the same on any Windows PC in India. Saved Chrome passwords, Gmail, Discord, Telegram, Wi-Fi passwords, Roblox and Steam accounts and crypto wallets are the same everywhere. And nothing stops a later version from adding Indian shops to the receipt search.

India is already a big target for this kind of malware. Microsoft's 2025 Digital Defense Report put India eighth in the world for customers hit by cyber threats in the first half of 2025. In June 2025, Cyber Swachhta Kendra, part of CERT-In, sent out an alert about Lumma, another infostealer that takes the same kind of data. And in October 2026, CERT-In marked an advisory about AI agents in attacks as critical. It looked at one attack on Indian companies that was out for money. There, AI tools cut the time between a break-in and the damage from days to a few hours.

"Criminals always picked the richest victims. AI adds nothing."

This is the best argument against all the noise, and it is partly right. Criminals have always sorted victims. Log markets already let buyers search by website or country. VOLTA's AI step is optional, and the malware works fine without it. No victims have been confirmed, and Talos itself calls the impact an open question.

That argument proves my point, though. If criminals always sorted, then sorting was always the slow, human part of the job, and the numbers above show it could not keep up with the flood of stolen data. Picking out the people worth a closer look by hand was the bottleneck. VOLTA removes it for anyone who buys the kit, including people who could never do that work themselves. A grep search cannot tell that a Wi-Fi password is a surname, that the surname matches an Amazon receipt, and that the same person keeps a crypto wallet on a gaming PC. A language model can, in seconds, for less than a dollar. Fetterman said it plainly to WIRED: advanced tools are reaching less skilled attackers.

What Anthropic and OpenRouter should do

Anthropic's model is the first name in this malware. Anthropic publishes detailed threat reports, and it should run VOLTA's exact prompt on Claude Opus 4.6 and its newer models, with a fake evidence bundle, and publish what happens. If Claude refuses, people deserve to know the guardrail held. If it writes the report, people deserve to know that too.

OpenRouter says it does not store prompts by default. On 27 October 2026 it announced that it will screen requests for child sexual abuse material as they pass through, and its terms let it scan for known malware. Nothing it has published says it looks for a 240-word prompt that asks for a "target assessment" built from someone's inbox. And a single key that can switch between hundreds of models in one line of code is what makes VOLTA's backup chain so easy. OpenRouter should start screening for requests that ask a model to profile a person from stolen data, and say how often it finds them.

My prediction

By 30 April 2027, a major security firm will report that at least one infostealer already sold on criminal markets has added an AI step that profiles or ranks victims. Lumma, StealC, Vidar and Acreed are the kind of names I mean. If I am wrong, I will say so here.

My reasons are in the reporting. Anthropic saw criminals doing this by hand with Claude in 2025. Talos found it built into a kit in 2026, along with another implant called CLOSEDQUORUM that lets up to four AI models vote on its next move. The cost is well under a dollar per victim, and big stealer brands compete on features. Once one of them adds ranked dossiers, the rest will follow.

Questions people are asking

What is VOLTA malware? VOLTA, which calls itself VOLTA-AUTODOXER, is a Windows infostealer. It steals logins, cookies, cards, crypto wallets and gaming sessions, checks your home address through your Gmail receipts, and sends a profile of you to an AI model to rank what you are worth. Cisco Talos described it on 31 October 2026.

What is an infostealer? Malware that copies saved passwords, login cookies, card details and crypto wallets from your computer and sends them to a criminal. It usually hides in cracked software, fake game cheats or fake updates.

Did Claude help the hackers? Nobody has shown that. VOLTA asks for Claude Opus 4.6 first, but no one has published what Claude answered. The malware is built to switch to Kimi K2 and Gemini 2.5 Flash if Claude refuses.

Does 2FA stop infostealers? Not on its own. Infostealers copy the session cookie from a login that already passed two-step login, so the criminal skips it. Signing out of all devices ends stolen sessions once the malware is gone.

Is it safe to save passwords in Chrome? It is far safer than reusing one password everywhere. But any password saved on a computer can be stolen if malware runs on that computer, so the most important step is not to install software from unofficial sources.

Where should I store my seed phrase? Offline, on paper or metal. Never as a file, screenshot, note or email.